Module 5.3 – Pattern Analysis

Pattern analysis involves reviewing past threat events to identify meaningful patterns or trends in the data. Generally, important patterns may be discerned by looking . These include the location of event (threat mapping), time of occurrence (of day, week, month or year), and the type of target or victim.

Location of event – Consider Example 1 below. Each X on the map represents a security incident, such as an armed attack or attempted attack recorded over the past year. What conclusion could be reached from the data shown? Given that five attacks have occurred along Highway A1 and none has occurred on Highway A3, a manager might decide that Highway A3 is safer and staff should use it for movement between the office and the camp.

Another common pattern for organisations working with refugee camps/locations in dangerous border areas is shown in Example 2 below. What conclusion could be reached from the data shown now? One possibility is that the camp is located too close to the border; Risk Managers might urge government authorities/the organisation to move the camp further into the interior of the country to ensure safety.


example of camp mapping







Time of occurrence – One useful aspect to look for the presence of a pattern is the time of day at which attacks have occurred. The 24-hour clock shown below is a good way to graphically display the information to reveal any pattern that may exist among the many attacks over the past year. threat analysis time of dayThe diagram is made by researching and then recording the time of day that road attacks have occurred. The result shown in the example is that generally attacks occur early in the morning, and late in the day (dawn and dusk). The pattern is very useful for security risk management as it implies that vehicles may still use this road with a reasonable risk, but perhaps not at dawn or dusk, and travel curfews and protocols should be put in place limiting travel at those higher risk times. Note that analysing time of occurrence for patterns should also include longer time periods than 24 hours. Do the events occur on specific days of the week or month? Is there a pattern of threat events increasing on holidays, weekly religious days for prayer, just before paydays (people short of money have more motive for theft) or after paydays (people with money to burn may go out and cause trouble)? Is the event influenced by the seasons (as many kinds of military operations are)? Plainly, for these larger time frames, calendars rather than clocks are used to show recurrent patterns.

Type of target – Pattern analysis by target requires analysing the available data with the specific focus on determining who was targeted. For example, consider the data in the pie chart below, threat pattern analysis pie chartwhich depicts the number of hostage-taking incidents among UN national and international staff between the years 1993 and 2004. Does this information indicate a pattern? Before you answer, an additional detail may be useful: international staff constituted only 20% of the UN staff population globally at the time of the study. Based on this ratio, we might expect that of 278 hostage incidents, international staff should be involved in about 55. The fact that nearly four times as many were kidnapped probably indicates a global pattern, perhaps because international staff members are deemed useful as hostages as they generate more media coverage or ransom. There are at least three other points, however, that should be noted in this example:

1) Hostage statistics vary greatly from country to country, and patterns in a given duty station may or may not mirror the global trend.

2) While international staff are taken hostage more often, national staff members figure more often in statistics of deadly attacks.

3) Recent years have seen an increase in the number of UN national staff taken hostage— perhaps in response to increased measures protecting international staff.

The key point is that people may be at greater or lesser risk of being selected as a target due to a number of demographic factors: nationality, ethnic group (or appearance of belonging to a particular nationality or group), profession, employer and of course gender. Careful consideration of target selection patterns is an important part of pattern analysis.

Identifying patterns and trends

Whatever patterns you choose to investigate, you will still need to gather the basic information first. An understanding of some of the possible patterns described above will be helpful in formulating questions or for asking for specific details that may be useful in your analysis. The tips below will help you to organize yourself for the assessment and give you some useful advice on how to start.

Pattern Analysis Tips

Compile data on past incidents — date, time, location, type, situation, and likely cause.For criminal threats, data from other expatriate organizations (especially UN agencies) may also be helpful.

Display the data in a way that makes it easy to analyse, such as a simple list. If it is difficult to identify patterns or trends with a list. Use an uncluttered map and color-coded pins, stickers, or markers (over plastic acetate).

To identify patterns, mark all of one incident type first, look for patterns, and then add another type. To identify trends, mark incidents in order of occurrence (identifying how the map changes over time) or divide the time frame in half, and do two maps.

To analyse the information, try to identify clusters of incidents of similar types; for example, car-jacking on a specific road.

If you are concerned about indirect threats (being caught in the crossfire) because the conflict has no clear battle lines, identify patterns and trends related to the conflict that may indicate dangerous areas (e.g., skirmishes, ambushes, and massacres).